Letter to Florida Courts Concerning Group 2 Privacy Recommendations

Re: Comments on Privacy, Access and Court Records / Report and
Recommendations of the Committee on Privacy and Court Records / Group Two

Dear Honorable Members of the Florida Supreme Court:

The Electronic Privacy Information Center (EPIC) is a public interest research
center in Washington, D.C. It was established in 1994 to focus public attention
on emerging civil liberties issues and to protect privacy, the First Amendment,
and constitutional values. EPIC occupies a unique space in this debate
because the organization both advocates for the right of privacy and pursues
access to government records under the Freedom of Information Act. EPIC
is one of two judicially-recognized entities with "news media"
status under the Freedom of Information Act.[1] EPIC is a strong supporter of access to government
information. At the same time, the presence of personal information within
public records raises serious privacy issues. EPIC previously submitted
comments to the Committee in November 2004, detailing how Florida citizens'
personal information stored in public records is collected, bought, and
sold, free of privacy restrictions.[2]

We applaud the Court and the Committee on Privacy and Court Records for
tackling the difficult public policy issues surrounding access to public
records. The Florida Report and Recommendations constitutes one of the
most progressive and comprehensive approaches to addressing the privacy
risks of public records in the nation.

At the outset, we wish to emphasize our principal concern:

The very purpose of public records—the ability of the individual to learn
about the government—is turned on its head when the records include excessive
personal information. Instead of being citizens' window into government
activities, public records are giving the government, law enforcement, and
data brokers a window into our daily lives. Without privacy protections,
court and other public records will be commodified for commercial purposes
unrelated to government oversight.

Court records are becoming the fodder for dossiers on Americans. Currently
in Congress, lobbyists from data companies are attempting to place an exemption
into privacy legislation that would free data companies from consumer protections,
so long as the information they sell is present in a public record. This
would mean that companies that traffic in sensitive personal information--including
Social Security Numbers--would not have to abide by security safeguards
or inform consumers if this information was stolen! The data brokers are
banking on the courts to pour personal information into the public record
so that it can be sold without privacy safeguards.

Literally, the data brokers are engaging in a circular form of advocacy.
They claim that their files do not implicate privacy interests because they
are drawn from public records. At the same time, they lobby vigorously
in every state and the federal level to increase the amount of personal
data in public records. They are dismissing privacy violations as trivial
with one hand while using the other to pour data into public records.

Under their approach, a newspaper that published a birth notice (that includes
date of birth, full name, and mother's maiden name) would be considered
a public record and that information could be freely sold. Babies do not
choose to publish this personal information, which is used for credit authentication
and other security purposes, but upon birth, public records exemptions already
start to erode one's privacy.

As Congress considers legislation to give individuals rights with respect
to commercial data brokers, it is imperative to limit the scope of personal
information that appears in public records. If, as the Recommendation notes,
privacy interests continue to "los[e] ground to economic and law enforcement
interests," all personal information in public records will be subject
to very little if any privacy protection. This will have wide ranging consequences
for individuals who wish to live a life free of identity theft, stalking,
profiling, and direct marketing that is driven by the inclusion of personal
information in public records.

Indeed, economic and law enforcement interests have merged in many respects
to erode privacy rights. Commercial data brokers are independent economic
powers in themselves, but also receive support from law enforcement interests
that wish to have more and more data on America's citizens.

Specific Comments

Minimization

Minimization is the most important approach to addressing privacy risks
associated with public records. We strongly support recommendation 7, and
suggest that heightened attention be focused on removing unique identifiers
from records. These include the Social Security Number, date of birth (in
some populations, date of birth is individually identifiable, and when combined
with other information, it can be individually identifiable even in large
populations),[3] telephone
number (commercial marketers are beginning to track individuals and households
by telephone number, because the number is relatively permanent), and home
address.

These unique identifiers do little to serve the interest in improving oversight
of government functions. They have little, if any, communicative value.
Instead, they are used primarily by big business and government to focus
in on the individual.

We further recommend that the Court revisit its minimization policy in
10 years to reevaluate what information needs to be collected.

[3] Carnegie Mellon Professor Latanya Sweeney has demonstrated
that anonymous data sets can often be readily "reidentified."
In one experiment, Sweeney, using 1990 Census data, demonstrated that
individuals often have demographic values that occur infrequently. Since
these values occur infrequently, they allow the re-identification of individuals
in putatively anonymous datasets. Sweeney found in her report Uniqueness
of Simple Demographics in the U.S. Population: "...87% (216 million
of 248 million) of the population in the United States had reported characteristics
that likely made them unique based only on {5-digit ZIP, gender, date
of birth}. About half of the U.S. population (132 million of 248 million
or 53%) are likely to be uniquely identified by only {place, gender, date
of birth}, where place is basically the city, town, or municipality in
which the person resides. And even at the county level, {county, gender,
date of birth} are likely to uniquely identify 18% of the U.S. population.
In general, few characteristics are needed to uniquely identify a person."